4 ms·
Transport Layer Security, which used to be known as SSL (eg, https). It uses up nearly half of our CPU time and our memory bandwidth to read data from memory
by drewg123 7y ago
Transport Layer Security, which used to be known as SSL (eg, https). It uses up nearly half of our CPU time and our memory bandwidth to read data from memory into the CPU, encrypt it, and write the encrypted data back to memory.
If we were serving plain http without TLS, we could probably reach 400Gb/s from this box (based purely on back of the envelope math)
- JoshTriplett 7y agoYou can't use any kind of TLS offloading accelerator?
- greglindahl 7y agoAre you asking what’s most cost-effective?
- JoshTriplett 7y agoI'm asking what best meets the requirements, which may be a balance of cost and performance.
- wmf 7y agoLooks like it's in progress: https://2019.eurobsdcon.org/slides/Kernel%20TLS%20and%20TLS%20hardware%20offload%20-%20Drew%20Gallatin.pdf https://2019.eurobsdcon.org/slides/Kernel%20TLS%20and%20TLS%...
- drewg123 7y agoThere are 2 classes of accelerators -- lookaside and inline. The lookaside accelerators (like QAT) sit on the PCIe bus and DMA plaintext into the accelerator, and DMA encrypted data out. This offloads the CPU, but it does not help with memory bandwidth. Since memory bandwidth is our biggest bottleneck, they don't help. Inline accelerators are "smart nics". The NIC DMAs a pre-formatted TLS record in plain text inside a (series of) TCP packet(s) from the host, encrypts it, and sends it in an almost stateless way. This is what we call "NIC TLS" in FreeSD. Sadly, the inline accelerators we've tried all have fatal flaws which prevent us from using them. I cannot get into those flaws for NDA reasons, but we're hopeful that there will be one that we can use soon.
- foobiekr 7y agoI did not mean what TLS is, I meant the context of the high performance numbers. Using what software, etc.
- ksec 7y agoRunning on FreeBSD, I did a quick search, turns out I submitted it on HN [1] exactly 5 months ago. And it was only running 200Gbps then [1] https://news.ycombinator.com/item?id=21043765 https://news.ycombinator.com/item?id=21043765